IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Guardium CAS and Microsoft Exchange

  • 1.  Guardium CAS and Microsoft Exchange

    Posted Tue March 31, 2020 04:34 PM
    Hello

    Maybe it's an old topic I've seen on one of the forums but I need your opinion or experience sharing on how to protect .pst files on a Microsoft Exchange server.

    My goal is to protect these files using only the CAS module, 'I don't have a FAM license at the moment'.

    I'm thinking of the following scenario:

    On the Micosoft Exchange server, install GIM manually.

    On the Guardium collector, deploy the CAS module on the Exchange server. No database, so no S-TAP.

    Can I be informed of changes made to .pst files? Can I be informed about the execution of the 'copy' command for example on these files or any other command to move these files?

    Thank you in advance

    Translated with www.DeepL.com/Translator (free version)

    ------------------------------
    Mohamed AFEILAL
    ------------------------------


  • 2.  RE: Guardium CAS and Microsoft Exchange

    Posted Mon April 06, 2020 02:24 AM

    CAS can provide information about:

    - content change of readable file

    - file metadata change

    - hash of file
    - windows registry change
    Checks are done on schedule basis so if you modify file and restore it between checks this operation will not be notified.
    So answering on the questions:

    - CAS can inform changes to .pst metadata (pst's are binary files)
    - CAS is not able to provide information about I/O operations on file



    ------------------------------
    Zbigniew (Zibi) Szmigiero
    IBM
    Warsaw
    ------------------------------

    Original Message


Related Content